hypersonica-prod - Hypersonica - Information Security Officer

London+ Equity2w ago

In Office EMEA Cybersecurity Logistics Auditor Security Analyst Chief Privacy Officer Risk Management Reporting

Requirements

• A hands-on information security professional with experience delivering cyber compliance in the defence or government supply chain. • Practical experience running Cyber Essentials / Cyber Essentials Plus certifications and working to DEF STAN 05‑138 and the MOD's supplier cyber protection requirements. • Solid experience implementing or auditing an ISO 27001 ISMS. A Lead Implementer or Lead Auditor qualification, or certifications such as CISSP or CISM, is a plus. • Enough technical depth in cloud identity, endpoint management, and network security to judge controls in practice, not just on paper. • Familiarity with UK Government Security Classifications and MOD security requirements for industry is a strong advantage. • Able to explain security clearly and pragmatically to engineers, leadership, and auditors alike.

Responsibilities

• Own day-to-day information security and cyber compliance for our UK operations, working closely with the CISO and the wider group security function. • Lead the annual Cyber Essentials Plus renewal from start to finish: defining the scope, finding and fixing gaps, gathering evidence, and working with the certification body through the assessment. • Get the company ready to meet DEF STAN 05‑138 at higher cyber risk levels. That means gap analysis, a prioritised roadmap, putting controls in place, and building the evidence that MOD supplier cyber risk assessments need. • Maintain and improve our ISO 27001 ISMS, including risk assessments, the Statement of Applicability, policies, internal audits, and management reviews. • Run information security risk management and threat modelling, and turn the results into clear priorities for the business. • Work with IT and infrastructure teams on technical controls, including identity and access management, endpoint hardening, vulnerability management, logging and monitoring, and backup and recovery. • Manage supplier and subcontractor security, including flowing contractual cyber requirements down to them and assessing their security posture. • Own the incident response plan, run exercises, and coordinate response and reporting to customers and authorities when incidents happen. • Deliver security awareness training suited to a fast-moving engineering organisation. • Report security posture, risks, and compliance status to leadership in clear, actionable terms.